Quick Summary
A phishing campaign targeting Indian users has been discovered, utilizing emails that impersonate the Income Tax Department of India. This attack aims to deploy Blackmoon malware, a known banking trojan, and uses a legitimate tool, SyncFuture TSM, to maintain persistent access to victims’ machines. The campaign has not been attributed to any specific threat actor, raising concerns about ongoing cyber espionage efforts.
The Securityish Brief
Cybersecurity researchers have identified a phishing campaign that targets Indian users by impersonating the Income Tax Department of India. This ongoing activity involves sending phishing emails that trick victims into downloading a malicious archive, which ultimately leads to the deployment of Blackmoon malware (also known as KRBanker) and SyncFuture TSM, a legitimate enterprise tool developed by Nanjing Zhongke Huasai Technology Co., Ltd, a Chinese company.
The malicious ZIP file contains five hidden files, with an executable named “Inspection Document Review.exe” used to sideload a malicious DLL. This DLL implements checks to avoid detection and retrieves further payloads from external servers. The malware employs advanced techniques to bypass User Account Control (UAC) prompts and masquerades as the legitimate Windows “explorer.exe” process.
Once executed, the malware can evade detection by security software like Avast Free Antivirus by simulating mouse movements to add malicious files to the exclusion list. This campaign exemplifies a sophisticated approach to cyber espionage, leveraging both malware and legitimate tools to gain control over compromised systems.
Implications for Users and Organizations
This incident highlights the increasing sophistication of phishing attacks and the need for vigilance among users. The use of legitimate tools like SyncFuture TSM in malicious campaigns raises questions about software security and the potential for abuse by threat actors.
Users should be aware of the signs of phishing attempts, such as unsolicited emails claiming to be from government agencies. Organizations must ensure robust security measures are in place to detect and respond to such threats effectively.
Monitoring user activity and implementing strict access controls can help mitigate the risks associated with such malware deployments. Additionally, educating users on recognizing phishing attempts is crucial in preventing successful attacks.
- Blackmoon: A banking trojan known for targeting businesses, first identified in September 2015.
- SyncFuture TSM: A legitimate enterprise tool repurposed in this campaign for espionage purposes.
- eSentire: The cybersecurity firm that reported on this ongoing phishing campaign.
Key Takeaways
- Be cautious of unsolicited emails, especially those claiming to be from government agencies like the Income Tax Department.
- Regularly update your antivirus software to ensure it can detect the latest threats.
- Educate yourself and your team about phishing tactics to recognize and avoid potential scams.
- Implement strict access controls to limit the potential impact of malware on your systems.
- Monitor user activity for any unusual behavior that may indicate a compromise.
Key Terms & Concepts
- Blackmoon Malware: In this article, Blackmoon refers to a banking trojan known for targeting businesses, first identified in September 2015.
- SyncFuture TSM: SyncFuture TSM is a legitimate enterprise tool that was repurposed for espionage in the described phishing campaign.
- Phishing: Phishing is a cyber attack method that involves tricking individuals into providing sensitive information through deceptive emails or websites.
Read the original article here: https://thehackernews.com/2026/01/indian-users-targeted-in-tax-phishing.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
